   ;; TODO - permissions check
   (let-404 [org (sel :one Org :id id)]
     (let-404 [user (sel :one User :id user-id)]
-      (grant-org-perm user-id id (or (:admin body) false))
+      (grant-org-perm id user-id (or (:admin body) false))
       {:success true})))
 
 


(defn grant-org-perm
  "Grants permission for given User on Org.  Creates record if needed, otherwise updates existing record."
  [user-id org-id is-admin]
  (let [perm (sel :one OrgPerm :user_id user-id :organization_id org-id)]
    (if-not perm
      (ins OrgPerm


(defendpoint GET "/:id/members" [id]
  ;; TODO - permissions check
  (let-404 [org (sel :one Org :id id)]
    (-> (sel :many OrgPerm :organization_id id)
      ;; TODO - we need a way to remove :organization_id and user_id from this output
      (hydrate :user :organization))))
